CVE case study
CVE-2026-76793: Unauthenticated Account Takeover in Firebase Authentication
The Firebase Authentication plugin before 1.7.1 matched an authentication token's email to a WordPress account without verifying the email, letting unauthenticated attackers sign in as any user. Version 1.7.1 requires a verified email.
- Weakness
- CWE-287
- Affected
- Firebase Authentication earlier than 1.7.1
- Remediation state
- Upgrade to Firebase Authentication 1.7.1 or later
- Advisory published
- 20 Aug 2026
Why it matters
The Firebase Authentication plugin logs a WordPress user in based on the email address carried in an authentication token. Before version 1.7.1, it did not require that email to be verified before matching it to an account.
That let an unauthenticated attacker present a token for any address and receive a session as that user, including an administrator. The public record scores it High at 8.1; version 1.7.1 requires a verified email.